self-improving-security

You can capture security learnings by logging vulnerabilities and incidents to dedicated .learnings files, then promoting broadly applicable findings into reusable runbooks, hardening checklists, and security playbooks for consistent remediation.

Promoting security findings to files like HARDENING.md and PLAYBOOKS.md extracts repeatable patterns from incidents and misconfigurations, turning isolated remediations into scalable hardening items and operational runbooks for continuous security improvement.

Yes, this security learning workflow applies across code, cloud, and operational environments, allowing you to log misconfigurations, access violations, and compliance gaps while enforcing safe-logging requirements and recording metadata like entry IDs.

The best way to track compliance gaps is logging them to .learnings/SECURITY_INCIDENTS.md with metadata like sources and entry IDs, then extracting and scaling repeatable remediation patterns into reusable SKILLs and documented runbooks.

Yes, the workflow supports cross-linking security incidents and vulnerabilities to documentation like COMPLIANCE.md, HARDENING.md, and TOOLS.md, ensuring that logged findings are systematically connected to relevant operational and compliance contexts.

You should promote a logged vulnerability to SOUL.md or AGENTS.md when the security finding is broadly applicable across teams and environments, elevating isolated local learnings into permanent hardening items and shared operational guidance.